Additional finding: Secondary firmware bug — boot sequence crash on cold boot (MEPC: 0x00000006) While investigating the sta.scan() crash, I discovered a second distinct firmware bug affecting the Tab5 in UIFlow2 v2.4.4. Description: On every cold boot, the device crashes during UIFlow2's initialization sequence before any user code runs. The device automatically reboots and boots successfully on the second attempt. Crash signature: Guru Meditation Error: Core 1 panic'ed (Instruction access fault). Exception was unhandled. MEPC : 0x00000006 MCAUSE : 0x00000001 MTVAL : 0x00000006 Key observation: The stack contains 0x7474696c (ASCII: "litt") pointing to a crash inside UIFlow2's LittlevGL/LVGL initialization sequence — not in user code. Reproducibility: 100% reproducible on cold boot Device always self-recovers on automatic reboot Completely independent of user code — happens before any user application starts This is a separate bug from issue #94 (sta.scan() at MEPC: 0x4ff13582). Both bugs share the same root environment (UIFlow2 v2.4.4 on Tab5) but occur at different stages and involve different subsystems.